publish Docker images to GHCR and optimize web Dockerfile

[Mateusz-Krajewski]

Summary

Improve deployments using pre-built container images and speed up / slim down the PHP Apache image build.

Changes

• GitHub Actions (docker-publish): Build and push cloudlog-web and cloudlog-db to GitHub Container Registry (ghcr.io). Tags follow semver (MAJOR.MINOR.PATCH), plus workflow_dispatch. Multi-arch linux/amd64 and linux/arm64 only (no linux/arm/v7 for the DB image—the official MariaDB image does not ship that variant).
• Cypress CI: Start the stack from docker-compose.prod.yml (pull then up).
• Web Dockerfile: Single layer for APT cleanup + PHP extensions (docker-php-ext-install -j$(nproc)), --no-install-recommends, enable curl PHP extension (used by the app), write uploads.ini with printf, fewer layers overall.
• .dockerignore: Much smaller build context by excluding large dirs
• fix: disable pasting .env file to image (.env from docker-compose dont work)

Notes for reviewers

• The first successful workflow run must publish images before docker compose pull works in prod/CI without a local build.
• GHCR package visibility may need to be set to public if you want anonymous image pulls.